This guide covers what GDP requires in regulated industries, how the ALCOA and ALCOA+ principles apply in practice, the most common documentation failures FDA cites in warning letters, and what a compliant documentation system looks like across paper and electronic formats.

What are Good Documentation Practices?

Good Documentation Practices (GDP) refers to the set of standards that govern how records are created, completed, reviewed, approved, stored, and retained in regulated industries. GDP applies to every employee who creates or modifies a record, not just quality personnel.

The FDA's own guidance on data integrity and the MHRA's guidance on GxP data integrity both define the core requirements in consistent terms. Documentation must be:

• Attributable: anyone reviewing the record can identify who created or modified it and when
• Legible: the record can be read clearly throughout its required retention period
• Contemporaneous: the record is created at the time the activity occurs, not reconstructed later
• Original: the record is the first capture of the data, or a verified copy of the original
• Accurate: the record reflects what actually happened, with no errors or omissions

These five principles form the ALCOA framework, first described in FDA guidance documents and now referenced across global regulatory frameworks including EU GMP Annex 11, the PIC/S guidance on data integrity, and ICH Q10.

ALCOA+ extends the original five principles with four additional attributes: Complete, Consistent, Enduring, and Available. A Complete record captures all data generated during an activity. Consistent records follow the same format and sequence each time. Enduring records survive in readable form for their full retention period. Available records can be retrieved promptly when needed for an inspection or audit.

Which regulations require GDP in your industry?

GDP is not a single regulation with a single citation. It runs through multiple regulatory frameworks depending on your industry and the type of records involved.

For pharmaceutical manufacturers, GDP requirements appear in 21 CFR Parts 211 and 212 for drug products, and in EU GMP Chapters 4 and 6 for European operations. The FDA's 2018 data integrity guidance document and the 2016 guidance on data integrity for drug manufacturers both provide detailed expectations.

For medical device manufacturers operating under FDA's Quality Management System Regulation (formerly 21 CFR Part 820), documentation requirements appear in the design controls, device master record, device history record, and quality system record sections. The FDA's Good Documentation Practices guidance provides the foundational principles applicable across regulated contexts.

For companies using electronic records and electronic signatures, 21 CFR Part 11 adds technical requirements on top of GDP: audit trails, access controls, system validation, and controls on record modification.

ISO 13485 Section 4.2 covers documentation requirements for medical device QMS. ISO 9001 Section 7.5 addresses documented information in a broader quality management context.

The ten most common GDP violations in FDA warning letters

Research published in the International Journal of Pharmaceutical Quality Assurance identified recurring documentation shortfalls cited in FDA warning letters. The patterns are consistent across inspection cycles:

1. Backdating entries. Operators record an activity after the fact and use the time the activity occurred rather than the time of the entry. FDA treats any record where the creation time cannot be verified as potentially unreliable.

2. Using correction fluid or obscuring original entries. In paper records, original data must remain visible. A single line through the error, initialed and dated, with the correction written alongside, is the required method. Whiteout and heavy strikethroughs are GDP violations.

3. Blank fields in completed forms. A blank field is ambiguous. It could mean the step was not performed, the result was not recorded, or the form was not used. Every field must be completed with either a result or a documented N/A.

4. Unsigned and undated records. A record without an identifiable author and a date of entry cannot be attributed, violating the first ALCOA principle. This applies to both paper signatures and electronic record entries.

5. Transcription errors without error correction documentation. When data is transferred from one record to another, errors occur. GDP requires that any transcription error is corrected using the approved correction method, not simply rewritten.

6. Pre-signed blank forms. Signing a form before completing it inverts the documentation sequence. The signature certifies the accuracy of the content, which cannot be true if the content does not yet exist.

7. Shared electronic system logins. Shared credentials mean that no individual can be held accountable for a specific record entry. This violates the Attributable principle and triggers 21 CFR Part 11 requirements for electronic records systems.

8. Disabled or incomplete audit trails. Electronic systems that allow records to be modified without creating an audit trail entry cannot demonstrate data integrity. FDA routinely requests audit trail reviews during inspections.

9. Records stored in unauthorized locations. Documents found outside the controlled document management system, such as informal spreadsheets used alongside official batch records, create a parallel documentation stream that cannot be validated.

10. Reconstruction of records from memory. Any record completed hours or days after an activity based on the employee's recollection rather than real-time observation is not contemporaneous. This is one of the most severe GDP violations because it makes the record's accuracy fundamentally unverifiable.

GDP for electronic records: additional requirements

Electronic documentation systems introduce compliance requirements that paper-based systems do not face. The core issue is that electronic data can be modified without leaving a visible trace unless the system is specifically designed to prevent or capture such modifications.

Under 21 CFR Part 11, electronic records used in regulated activities must meet requirements for:

• System validation confirming the system does what it claims and protects record integrity
• Individual user authentication with unique credentials for every person who creates or modifies a record
• Audit trails that are computer-generated, time-stamped, and not modifiable by users
• Record retention controls that prevent deletion of original data
• Logical security controls limiting record access to authorized users by role

FDA investigators specifically check audit trail functionality during inspections of electronic QMS and laboratory information management systems. A system where audit trails can be disabled, where logs show gaps, or where the same user account appears across multiple locations simultaneously will be cited.

How GDP training should be structured

GDP failures in inspections almost always trace back to one of two root causes: employees were never trained on the specific requirements, or training happened once at onboarding and was never reinforced.

An effective GDP training program covers:

• The ALCOA principles in plain language with examples specific to the employee’s role and record types
• The approved error correction method for paper records, demonstrated with a worked example
• The specific electronic system controls employees use, including how audit trails work and why shared logins are prohibited
• A review of actual GDP violations from internal audits or industry warning letters, so employees understand the real-world consequences

Training records must themselves comply with GDP. A training log that does not capture who attended, when, and what version of the material was used is not a compliant training record.

GDP and document control: how they work together

GDP governs how records are created and maintained. Document control governs how documents are managed across their lifecycle, from creation through review, approval, distribution, revision, and obsolescence.

The two systems reinforce each other. A document control system that distributes controlled procedures to the right employees, at the right revision level, at the right time, gives those employees the correct basis for creating compliant records. A GDP-compliant record creation process ensures that what actually happens in the facility matches what the controlled procedures require.

When document control fails, GDP often fails alongside it. Employees following an outdated procedure create records that do not match the current approved version, regardless of how carefully they documented their activities.

What a GDP-compliant QMS looks like in practice

Cloudtheapp's QMS platform supports GDP compliance through pre-validated electronic record management with individual user authentication, immutable audit trails, and role-based access controls built into every application.

The platform's document control module maintains a single controlled version of every procedure, routes approvals through defined workflows, and prevents employees from accessing superseded documents. Electronic records created within the system are automatically attributed to the authenticated user, time-stamped at the moment of entry, and stored with a complete modification history.

For companies transitioning from paper-based records to an electronic QMS, Cloudtheapp provides a validated system that meets 21 CFR Part 11 requirements out of the box, removing the need to build and maintain custom validation infrastructure for each application.

Learn more about how Cloudtheapp handles document control and electronic records at: https://www.cloudtheapp.com/demo/

Key takeaways

Good documentation practices apply to every person who creates a record in a regulated company, regardless of their role or department. The ALCOA and ALCOA+ principles define what every record must demonstrate: that it was created by an identified person, at the time of the activity, capturing the original data accurately, and that it remains available and legible for its full retention period.

The most common GDP violations in FDA warning letters are preventable with proper training and systems that enforce correct documentation behavior rather than relying on individual compliance. Electronic records introduce additional requirements under 21 CFR Part 11, particularly around audit trails and individual user authentication, that paper systems do not face.

This post created by and appeared first on Cloudtheapp